Need help creating an external lookup with Python.

andrewj84 — Tue, 06 Oct 2020 20:43:13 GMT

Hello,

I've read through the documentation on external lookup with python and read through a few posts, could use some guidance. What I am trying to do is use this python script. Giving the script arguments protocol src_ip dest_ip src_port dest_port, gives you a calculated hash. Running it on its own works fine. This is what I've done so far:

Python script added to:

$SPLUNK_HOME/etc/apps/search/bin

Added stanza to transforms.conf:

[cid] external_cmd = community-id.py Protocol SourceIp DestinationIp SourcePort DestinationPort external_type = python fields_list = Protocol, SourceIp, DestinationIp, SourcePort, DestinationPort

I've tried several examples of search commands that was in the documentation and what others have used, but haven't returned any results (errors). So im not really sure if I'm doing this correctly. I've noticed that some examples have their python scripts output to a .csv? is that necessary? should I approach this another way?

BLUF: I want to pass some fields into a python script to give me a calculated hash in a new field.

topic Need help creating an external lookup with Python. in Splunk Dev

Need help creating an external lookup with Python.